Wireless security testing: what assessors check and how to harden Wi-Fi

Why Wi-Fi gets special attention

Wired networks stop at the wall socket; wireless networks spill into car parks, corridors and neighbouring offices. Anyone within range can try to connect, listen or set up a fake network that looks like yours. This is why wireless testing is a separate part of many ethical hacking engagements. As always, it needs written permission for the specific site and networks. Testing a neighbour's Wi-Fi, or a café's, is illegal without authorisation. Basics of Wi-Fi are covered in Wi-Fi basics.

Encryption and authentication

WPA3 is the current standard and protects personal networks better against offline password guessing by using a newer handshake called SAE (Simultaneous Authentication of Equals). WPA2 is still common and acceptable with a long, random passphrase. WEP and WPA (the original) are broken and should never be used. Wi-Fi Protected Setup (WPS) PIN mode has known weaknesses and should be turned off.

Organisations should prefer Enterprise mode, where each person or device authenticates through 802.1X to a RADIUS server, ideally with certificates. Leavers then lose Wi-Fi access when their account is disabled, and nobody shares a passphrase that ends up written on a whiteboard.

Rogue and fake access points

• A rogue access point is an unapproved device plugged into the network, often by a staff member wanting better coverage. It can open a hole straight past the firewall.
• An evil twin is a fake network broadcasting the same name as a real one, hoping devices connect and send credentials through it.

Assessors walk the site with a wireless survey tool to list every network and match it against the approved inventory. Defences include wireless intrusion detection built into many enterprise controllers, 802.1X with server certificate checks so devices refuse fake networks, and port security on switches so unknown devices cannot plug in.

Other wireless technologies

A full assessment may also look beyond Wi-Fi. Bluetooth devices such as keyboards and headsets, wireless presentation systems in meeting rooms and smart building devices can all create unexpected entry points. Assessors list what is broadcasting, check that devices are updated and paired securely, and recommend turning off radios that are not needed. Building an approved inventory of wireless devices makes the next assessment much faster.

Guest networks and signal reach

Guest Wi-Fi should sit on its own VLAN with internet access only, and client isolation should stop guests seeing each other. Testers check that they cannot reach printers, servers or management pages from the guest network. They also measure how far the signal travels outside the building; reducing transmit power or adjusting antenna placement limits how much of your network reaches the street.

Real-world example: a hotel's guest Wi-Fi

A fictional hotel hires an assessor before refurbishing its network. The survey finds that guest Wi-Fi and the reception PCs share one flat network, so from a guest room the assessor can see the card terminal management page. A rogue access point is also found in the kitchen, added by staff to stream music. The hotel moves guests to an isolated VLAN with client isolation, moves staff Wi-Fi to WPA3-Enterprise, removes the rogue device and enables rogue detection on its controller. A follow-up test confirms that guests can now reach only the internet.